Description (CNA)
In the Production Environment extension in Netmake ScriptCase through 9.12.006 (23), the Administrator password reset mechanism is mishandled. Making both a GET and a POST request to login.php.is sufficient. An unauthenticated attacker can then bypass authentication via administrator account takeover.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| ScriptCase / ScriptCase | affected 0 through 9.12.006 (23) |
CWE
CWE-684
References
- https://www.scriptcase.net/changelog/
- https://www.synacktiv.com/advisories/scriptcase-pre-authenticated-remote-command-execution
- https://github.com/synacktiv/CVE-2025-47227_CVE-2025-47228
ADP enrichment
No English description supplied.